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MANAGEMENT SYSTEM AND 
METHOD FOR MONITORING SITUESS 
INANETWORK 

5 

The present invention relates to the management of a communications system or 
network, and more particularly to the monitoring of '*stress'* in a network. 

The following description is concerned with a data communicatioDS system such 
10 as a local area netwoik (LAN), that is an Ethernet network. However, the skilled person 
\^dll appreciate that the present invention will have more general applicability to other 
types of managed networks inchiding wireless networks. 

A local area network (LAN) typically comprises a plurality of compiiters, 
IS computer systems, workstations and other electronic devices connected together by a 
common media such as twisted pair or coaxial cable or fibre optic cable. Data can be 
communicated between devices on the network by means of data packets (or frames) in 
accordance a predefined protocol 

20 Computers and other devices connected to a network can be managed or 

umnanaged devices. A managed device has processiiig capability \^ch enables it inter 
alia to monitor data traf5c sent fi-om, received at, and passing through the ports of the 
device. Monitored data associated with the ports of the networic device is stored in 
memory on the network device. Unmanaged devices do not have this processing 

25 capability. 

It is becoming increasmgly common and necessary for an individual to be 
2^}pointed to manage a network. The £^)pointed netwotk manager (or administrator) 
utilises a netwoik management station which inchides network manag^nent hardware and 
30 software. In particular, the network management station is able to access management 
data from managed network devices using an appropriate management protocol (e.g. the 



SNMP protocol) and display this data for use by the network manager. 

Known network management systems simply read the management data from the 
managed network devices and present this data to the network manager, typically in the 
form of numeric text, substantially unchanged. The network manager is expected to 
interpret the data in managing the network. 

One of the inqjortant tasks of a network manago" is to assess the operational 
performance of the various network devices and links as well as the network as av\iiole. 
The networic manager needs to know when problems are arising within the network and 
which particular network devices are responsible for such problems etc. 

Typical problems which may affect the performance of a network indude; 

1. slow operating speed of the netwoik, and individual network devices, 
leading to slow movement of data trafBc across the network, indicated by e.g. slow 
response time for a given network device; 

2. higji volumes of data traffic on the netwoik due to e.g. over- utilisation of 
the network links, networic devices and the network as a -whole; and 

3. high error rates in the transmission of data packets across the network, 
indicated by e.g. the loss of data packets in a network device and arors in received data 
packets. 

The aforanentioned problems which occur in the operation of a network 
contribute to the poor "health" of a network. The concept of the health of a network is 
weD known in the field of network managemait. In the present description, however, it 
is more convenient to refer to the "stress" of a netwoik (or network device or link) rather 
than its "health". It wiU be understood that a high level of stress equates to a low level 
ofhealdiandv/cevewa. Although the present invention is described as monitoring stress 
in a network, it will be appreciated that the present invention is equally applicable to 
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monitoring health in a network. 

Problems which affect the performance of a network, and therefore contribute to 
the level of "stress", may be of greater or lesser significance. For instance, a problem 

5 with the operating speed of an end station may be less significant than a problem with the 
operating speed of a central core device such as a switch. Thus, the level of stress of a 
network depends upon a number of &ctors inchiding device type, netwoik media type and 
the type of problem occurring. The network manager must take all such factors into 
account when interpreting the management data recdved fit)m the managed network 

10 devices to establish whether the performance of the network is satisfectory. 

It would be desirable for a netwoik management system to monitor characteristics 
of network devices and links which are indicative of problems occurring in a network 
which contribute to "stress", (such characteristics are referred to herein as "metrics") and 

IS provide data to the netwoik manager mdicadve of the level of stress which is easy to 
interpret It would fiirther be desirable to determine a value indicating the overall 
performance of each netwoik object (a "netwoik object" is defined herem as a network 
device or link) on a network and/or the overall performance of parts of, or all of, the 
networic, so that the network manager would not be required to interpret the monitored 

20 data, but could immediately ascertain the performance of the netwoik (or part of the 
network) fi-om the value provided by the networic management system. 

In accordance with a first aspect, the present invention provides a method for 
processing data representing monitored charact^istics in a network comprising netwoik 
25 devices and links to provide a stress value representing the performance of the network 
or a part thereof, the method comprising: 

obtaining a raw vahje of data for a monitored characteristic of a network device 

or Imk; 

comparing said raw value with a predetermined threshold value for said monitored 
30 characteristic; 



if said raw data value is greater than or equal to said threshold value, providing 
a stress value equal to a default value, said default value being a maximum or minimum 
value of a predefined bounded range; and 

if said raw value is less than said threshold value, calculating a stress value within 
said predefined bounded range using an ^propriate algorithm for said monitored 
characteristic. 

In accordance with a second aspect, the present invention provides a computer 
readable medium having a computer program for carrying out the method of the first 
aspect of the present invention. 

In accordance with a third aspect the present invention provides network 
management apparatus for processing data representing monitored characteristics in a 
network comprising network devices and links to provide a stress value representing the 
performance of the network, the apparatus comprising: 

a network connection or port for receiving a raw value of data for a monitored 
characteristic of a network device or link; 

a processor for comparing said raw value with a predetermined threshold value 
for said monitored characteristic obtained fi^om memory; and if the conq)arison determines 
that raw data value is greater than or equal to said threshold value, providing a stress 
value equal to a defeult value, said de&ult value bdng a mavrnwim or miTiimiiTn value of 
a predefined bounded range; and if the comparison determines that said raw value is less 
than said threshold value, calculating a stress value within said predefined bounded range 
using an appropriate algorithm for said monitored characteristic stored in memory. 

The present invention thus obtains a value for the stress of a network, network 
object or part thereof within a predefined, bounded range, that is to say a "normalised" 
stress value. Since the stress value is a normalised value, is easy to understand, and 
requires no interpretation by the network manager. 
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Embodiments of the present invention will now be described, by way of example, 
with reference to the accompanying drawings, in which: 

Figure 1 is a block diagram of a typical network having a network management 
system according to a preferred embodiment of the present invention; 

Figure 2 is a stress mapping graph for a first stress metric which may be monitored 
by the network managemait system in accordance with the present invention; 

Figure 3 is a stress mapping graph for a second stress metric which may be 
monitored by the network management system in accordance with the present invention; 
and 



Figure 4 is a flow chart showing the steps carried out by a computer program in 
accordance with a prrferred embodiment of the present invention. 

Figure 1 shows a typical network 1 incorporating a network management system 
according to a preferred embodiment of the present mventioa The network 1 includes 
a network management station 3A which incorporates the necessary hardware and 
software for network management. In particular, the network management station 
includes a processor, a memory and a disk drive, and preferably also a modem for mteraet 
access, as well as user interfeces such as a keyboard and mouse, and a visual display unit. 
Network management application software in accordance with the present invention is 
loaded into the memory of management station 3 A for processing data as described in 
detail below. The network management station 3 A is connected by network media links 
5 to a plurality of managed networic devices including core devices such as network 
switch 7, hubs 11, a router (not shown) and end stations, which may be managed or 
unmanaged, including personal computers 3 and workstations. The network may also 
include unmanaged devices, for «cample peripheral devices such as printers etc. 
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The network management station 3 A is capable of communicating with the 
managed network devices such as network switch 7 and hubs 1 1 by means of a network 
management protocol (e.g. the SNMP protocol) in order to obtain network management 
data. Each managed device includes a processor which monitors and stores data in 
5 memory on the device, and such data may be represented to an external management 
station by a MIB (management information base), as is well known in the art, including 
data relating to inter alia data traflGic at the device. A typical managed device monitors 
data contained in a number of MIBs, (of which one or more contains data used in the 
present invention). An example of a MIB containing network managanent data is MTR-TT 

10 (formerly MIB-I) as specified by the IETF (Intemet Engmeering Task Force) in 
specification RFC1213: MIB-II is common to most vendors' core devices and any 
network management system should preferably be capable of reading and utilising 
management data fi-om MIB-II. Furthermore, the network management system of the 
preferred embodimOTt of the present invention is additionally capable of reading and 

15 utilising more complex management data contained in such MIBs as RMON (Remote 
Monitoring MIB, RFC1271), RMON2 (Remote Monitoring MIB 2, RFC2021), the 
standard bridge MIB (RFC1493), the standard repeater MB (RFC1516), or any 
proprietary MIBs produced by original equipment manufiicturers (e.g. the 3Com Remote 
PoUMB). 

20 

In accordance with the preferred embodiment of the present invention, the 
network management station 3 A obtains data about a certain metric for a network object 
which is indicative of the level of "stress" of the network object. For example, the station 
3 A may request from a managed device, such as switch 7, a single piece of information 

25 (called an "object instance" or SNMP variable) fi-om a MIB about a particular state of the 
device such as the current error rate in data packets sent fi-om and received at one of its 
ports. In accordance with the present invention, the data obtained from the MIB is 
processed using a predetermined "mapping algorithm" for error rate in a port of the 
switch to obtain a "normalised" stress value (as explained in more detail below). The 

30 normalised stress value may be displayed on the visual display unit of the network 
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management station or otherwise communicated to the network manager, e.g. via a 
printer or through another application such as a word processing application. The 
normalised stress value represents the perceived level of stress of the network device (i.e. 
a level which takes into account all relevant factors including the type and location of the 
5 network device) which can be readily understood by the network manager as indicating 
whether the level of stress is acceptable. 

The network management system may also obtain metric data foranetworic object 
without accessing a MIB in a managed device. For example, the network management 
10 station 3A may send a signal to a device over a link ^ch prompts a response from the 
device (e.g. by IP ICMP echo or ff Kng, as is known in the art). The network 
management station will itself then monitor the time taken to receive a response from the 
device. The normalised stress value is then determined using a predetermined *^mapping 
algorithm" for the monitored metric. 

15 

The following tables represent examples of the information/characteristics winch 
the network management system, according to the preferred embodiment of the present 
invention, monitors. In the tables, the monitored information/chanicteristic is called a 
"metric" and the typical level of the raw measured value which represents an unacceptably 
20 high level of stress poor performance) is called the "defiwlt threshold" . The defeuh 
threshold is set by the vendor of the network management system but may adjustable by 
the user, if required. 

Examples of metrics obtained by the network management station from a network 
25 device are shown in Table 1. These stress metrics are examples of characteristics 
monitored by the network management system to ensure that parts of the networic devices 
(i.e. discrete hardware or software components) are operating in an acceptable fashion. 



30 
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Table 1 





metric 


typical default threshold 




IP Ping response time 


1000 milliseconds 


5 


DNS response time 


1000 milliseconds 




FTP response time 


1000 milliseconds 




HTTP response time 


1000 milliseconds 




POPS response time 


1000 milliseconds 




SMTP response time 


1000 milliseconds 


10 


NFS response time 


1000 milliseconds 



(Note that not all devices will have all of the functions indicated by the metric. The 
network management station of the prefeired embodiment only sends signals appropriate 
for each network device to obtain the metrics for that device). 

15 

Examples of metrics obtained by the network management station requesting 
information contained in a MIB in a managed network device such as switch 7 are shown 
in Table 2 . These stress metrics are examples of the characteristics monitored in a core 
device to determine whether errors and botdenecks of data traflBc (due to 
20 excessive traffic) are occurring in the device. 



Table 2 





metric 


typical default threshold 


25 


frames discarded due to 


0 frames per second 




excessive delay 




frames discarded due to 


0 frames per second 




MTU exceeded 




frames discarded because 


0 frames per second 


30 


filtering table fiill 




rate of topology changes 


0 per second 



(Note that the metrics listed in Table 2 are monitored and stored in most layer 2 switching 
devices such as bridges or switches.) 



E'^Plesofmetricsobtainedbythenetworkmanagementstationfro^ 

device sudiasalmlfduplexEthemetint^fece or port o^a^etworkde^dce are shown in 
Table 3. These stress metrics are examples of characteristics monitored to identify 
problems occurring at the ports of networic devices such as over-utilisation of the link 
connected to the port. 





Tables 




metric 




typical default thrft8hnM 


link utilisation 
link error rate 
collisions 
broadcast frames 


35% bandwidth 
5 % all frames 
20 per second 
3000 per second 



(Note that the metrics Ksted in Table 3 are monitored and stored for each port in most 

managed network devices which suppoitaMB capable of monitoring traffic flow ona 
port (e.g. MB-n, RMON, repeater MIB, or a similar operating Mffi).) 

FinaDy. an example of a metric obtained by the network management station 
requestmgdatafromamanagednetworicdevicewhichsupportsaproprietaryMB for 
example a NIB of 3Com Co^KJiation, is response time fo,m end of link, which ^ 
typicaldefeuhthresholdoflOOOmiDiseconds. Tie network management station requests 
from thenetworicdcvicethis data, and theprocessor in the networic device sen^ 

to the fir end ofthe link and times the period for a response to be received. TTie 
monitored response time is then provided to the management station as a raw value 
mdicative of problems relating to the speed of transmission of data across the netwo± 

Anonnalised stress vahieisdeterminedby the networicmanagementsystemofthe 
preferred embodiment using an appropriate algorithm as discussed in more detail below, 

based ona)the characteristics oftheinfonnation being requested;b)thetypeofm^ 
device being monitored, and c) the type of media to which the device is attached. In the 
embodiment, the stress value is "normalised" for all stress metrics within a predefined, 
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bounded range. In the preferred embodiment the range is 0-100 where 100 is an 
unacceptable level of stress. As mentioned previously, the stress value for each metric is 
determined using an appropriate "stress mapping" algorithm which considers the 
aforementioned factors a) to c) to provide an appropriate level of perceived stress in the 
range 0 to 100 to the user. In particular, the stress mapping applied to any monitored 
value will always return a stress value m the same range i.e. 0 to 1 00, The stress mapping 
algorithms for all monitored values (i.e. all metrics for all networic objects) are designed 
such that a given reported stress value always has the same meaning for the user, no 
matter which raw monitored value (i.e. metric) was used to genwate the stress value. A 
better understanding of the manner of implementation of the stress mapping algorithms, 
which are predetermined by the vendor of the network management system, will be 
appreciated from Examples 1 and 2. 

Example 1 :First stress metric - Link utilisadon 

The network management station 3A requests from the network switch 7 a 
numerical value (or object instance) in MIB-n (and also in RMON) for determining the 
hnk utilisation at a particular port of the switch 7. As is well known in the art, the 
processor m switch 7 will monitor the numbers of data packets and bytes which are 
transmitted from and received at each of its ports and store this data in memory as an 
appropriate MB. The network managemrat station 3A receives the MEB data for a 
particular port and therefore the link connected to the port, and knowing: the type of link 
and its state of operation, and therefore its bandwidth; and, the elapsed tune since the last 
request and the last requested value, and hence the trafl&c rate since the last request; 
determines the % utilisation of the link. The % utilisation of bandwidth of the link is 
referred to below as the "utilisation value" and is a "raw value" (i.e. before stress 
mapping). 

The network management station then compares the utilisation value with the 
defauh threshold for the link stored in its memory (e.g. 35% bandwidth in accordance 
with Table 3). If the utilisation value exceeds or equals the default threshold then the 



15 



20 



25 



unacceptably high level of stress. If the utflisation value is below the default threshold 
then the processor utilises an appropriate stress moping algorithm to deteimine the stress 
value within the range 0 to 100 corresponding to the utilisation value. 

The relationship between the utilisation vahie and the perceived level of stress is 
non- linear. The stress mapping for link utilisation may be represented as diown in Figure 
2. As can be serai from this graph, the pocaved stress on the network fink increases 
dramatically from about 30% to an unaccqrtable levd at 35% bandwidth utilised (the 
defeult threshold in Table 3). Thus 35% bandwidth utilisation or greater equates to tiie 
n^^^ YimiiTn stress value 100 as explsaasd above. 

Atleveisbdow35%bandvndthutilisation,tiienon-lmearrdationshipbetweenlink 
utilisation and percdved stress may be represented by key points as shown in Table 4. 



TaMe4 



raw value 


streiisrotolOOl 


0 


0 


5 


1 


8 


2 


10 


5 


20 


10 


25 


20 


30 


30 


32 


50 


35 


100 



The implementation of the stress mapping algorithm extrapolates tiiese key points 
to detennine the appropriate stress value between 0 and 100 for any raw value (utilisation 
value). 



Example 2:Second stress metric - Link error 
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The network management station 3A requests from the network switch 7 the 
nimiber of error frames received at a certain port and the number of data packets received 
at that port. This data is contained in a MB of the switch 7 such as MIB-II, RMON, or 
a similar standard or proprietary MDB. As is well known in the art, the processor in 
5 switch 7 keeps a coimt of the number of data packets which are received at each of its 
ports, and the number of data packets recdved m error at each of its ports, and stores this 
data as an ^propriate MIB. The network management station 3 A receives the 
aforementioned MIB data for a particular port and knowing the elapsed time since the last 
request and the last requested values, determines the % data packets in error on the link. 
10 The % data packets in error on the link, i.e. the error rate, is referred to below as the 
"error value" and is a "raw value" (i.e. before stress mapping). 

The network management station then compares the error value with the default 
threshold for errors on the particular link stored in its memory (e.g. 5% frames in error 
15 in accordance with Table 3 ). If the error value exceeds or equals the default threshold 
then the stress vahie is determined to be the maximimi stress value i.e. 100, indicating an 
unacceptably high level of stress. If the error value is below the default threshold then the 
processor utilises an appropriate stress mqjping algorithm to detemiiine the stress value 
within the range 0 to 100 corresponding to the error value. 

20 

The relationship between the error value the perceived level of stress is non- linear. 
The stress mapping for link error may be represented as shown in Figure 3 . As can be 
seen from this graph, the perceived stress on the network link increases dramatically from 
about 4% error rate to an unacceptable level at 5% frames in error (the default threshold 
25 in Table 3). Thus 5% error or greater equates to the maximum stress value of 100. 

At levels below 5% error, the non-linear relationship between % frames in error 
and perceived stress may be represented by key points as shown in Table 5. 



30 
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Table S 



raw value 


stress fO to 100^ 


0 


0 


1 


1 


2 


2 


3 


5 


4 


30 


5 


,100 



The implementation of the stress mapping algorithm m the network management 
station ^ctrapolates the key points in the stress mappmg shown in Table S to obtain a 
stress vahie within the range 0 to 100 corre^nding to any raw value (i.e. error value). 

15 

In accordance with the preferred embodiment of the present invention, the 
network management station 3A stores in memory the stress mapping algorithms and 
de&ult thre^oids for all stress metrics monitored in the management system. The 
processor of the networic managem^ station running the application software carries out 

20 the steps ^own in Figure 4. At step 101 the program obtains for a particular network 
object a raw data value (or object instance) for a given metric and in step 102 compares 
it to the de&ult threshold Ifinstep 103 it is found that the raw data value is greats than 
or equal to the de&uh threshold, a de&uh condition arises whereby the processor 
determines that the stress value is a de&ult value in step 104, which in the preferred 

25 embodiment is a maxfanum (lq. 100). Otherwise, the processor retrieves the appropriate 
algorithm for the metric in step 105 and calculates the normalised stress vahie (Le. 
between 0 and 100) m step 106. 

The thus detennined stress value represents meaningfiil information to the network 
30 manager since it is normaUsed within a predetenmned rai^e. If the normalised stress 
vahie is then sent to a display unit in step 107 to be displayed or to a printer to be printed 
e.g. as a number on the visual display unit of the network management station, together 
with a large number of other normalised stress values, the network manager can simply 
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look for high numbers (say above 50) to detect potential problems. Accordingly, by 
utilising "stress-mapping" to determine a normalised stress value for each metric of a 
network object, the network manager can compare the stress of different areas of a device 
or different parts of the network and be able to judge which areas need the most xxrgent 
5 attention, without the need to analyse the data for each device to determine whether it has 
a relatively high stress level for the type of device, the type of media link and the operating 
state of the link. 

The network management system in accordance with the preferred embodiment 
10 of the present invention is designed to monitor a plxirality of different stress metrics for 
each network object. The system retrieves the monitored data for some or all of the 
metrics appropriate to a given network object and aggregates the data to form an overall 
object stress value as explained below. This enables the user to view the data for an 
individual network object and asc^tain its overall performance. 

15 

For instance, the stresses of a plurality of individual stress metrics of a network 
device are monitored and the data obtained is aggregated to form an overall device stress 
value. 

20 A network device such as switch 7 is typically composed of the following 

components: 

- a stackable backplane of some kind to which individual units (i.e. switches, 
routers etc) may be attached; 

- a bus within each unit into which blades can be inserted; and 
25 - ports or mterfeces on each blade. 

The stress of these components may be aggregated together to provide an overall 
stress value for the network device. Similarly, the stress of multiple network devices may 
be aggregated together to provide a single metric for overall network stress. 

30 
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Examnle 3: Aggregatinn strategy for < 
device 



ess values for a plurality of metrics in a notn,orU 



In this example, the aggregation strategy for a given networic device such 
switch 7 (which may be a stacked device fonned from several units) is as foDows: 



as 



Step 1 : The stress of each blade is determined to be the worst of 

-theblade'sownmonitoredstr^CLe.thestressderivedusingmeasura^ 
on the blade ttself);and 

- the worst stress of any of the ports (or intafeces) on that blade 

Step 2: The stress of each unit is determined to be the worst of; 

- the unit's own monitored stress; and 

- the worst stress of any of the blades inserted in that miit (as determined in Step 

1) 



Step 3: The stress of each network device is determined to be the worst of: 

- the device's own monitored stress; and 

- the worst stress of any of the mnts which are part of the device (as determined 
in Step 2) 

The overaD stress of the network can then be determined, for example to be the 
^^orst of the stresses of all of the network objects within the network. 

The overall stress of the netwo± is thus the worst strxsss of any individual 
monitored component within the network. 

Example 4:Altemative aff>n^ ^on strate^ p.< 



advanced aggregation strategies may follow the strategy of Example 
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3, but with the following additions: 



1. For a unit or blade, also consider the eflFect that the bad performance of that 
component has on the parent component's ability to support other constituents. 

5 

For example, a blade which is under high stress may aflFect the performance of 
other blades if it congests the common, shared backplane. A unit \^ch is under high 
stress may aflFect the performance of a netwoA device if it congests the device's single 
interface onto the networic 

10 

2. For the network device, unit or blade, the stress of the component may be 
determined to be worse or better than just the worst of the constituent components. 



For example, the stresses of the interfaces on a blade may be 60, 70 and 80. But 
the network management system may intelligently decide that this combination of very 
high stresses means that the blade itself is stressed to, say, 90. If the stresses were 10, 10 
and 80, the management application may decide that this single high stress does not 
warrant a blade stress of 80, but perhaps only 50. 

As described above, in accordance with a preferred embodiment of the present 
invention, the network management system monitors a plurality of stress metrics for all 
of the managed devices on the network, and in addition to aggregating the data for each 
object (e g, device) to form an overall stress value for that object (e.g. device), the 
network management system may additionally aggregate together the overall object stress 
values of aU of the network objects to provide an overall stress value for the network. 
Alternatively, the network management system may aggregate the worst of the underlying 
stresses of each of the devices, or at each network level, to provide the overall network 
stress values. In the latter case, the overall network stress value will represent the stress 
value of the least healthy device or component across the whole network. 



The network management station in accordance with the invention may monitor 
stress periodically or in response to commands from the network manager 

As will be appreciated from the foregoing, in acconJance with a preferred 
embodmient, the present invention is implemented in the fonn of a software appUcation 
which may be provided in the form of a computer p,x,grBm on a computer readable 
medium. The computer readable medium may be a disk ^ can be loaded in the disk 
dnveofnetworkmanagementstationSAorthecomputersy^emcartyi^ 
other form of file server (e.g. FTP) of, for sample, the suppHer of network devices 

whchpennits downloading of theprogrambyamanagementstationovertheto^^^ 
Theprogramsteps 101 to 107 are illustrated in Figure 4 and have been described 

above. 



As the skilled person wiD appreciate, various modifications may be made to the 
described embodiments and examples. For instance, as previou^y mentioned, if the 
mvention is appHed to detennine a health vahre in a networi, it ^ be appreciated that 
the same metrics, raw values and defiuA thresholds WiD be appKcable as for stre^^ as 
describedabove. However, the mappi.^ algorithms ^difer. and the defiudt threshold 
willreturntheminimumvahrewithinthenormalisedrangeindi^ The 
networic manager will then need to look for low vabes of health to detect potential 
problems in the n^ork. 

Thepresentimrentionis intended to incbdeaDsuchmodifications and equiv^^^^ 
wbchMwithinthescopeofthepresentinventionasdefinedintheac^ompanyingcl^^ 
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CLAIMS: 

1 . A method for processing data representing monitored characteristics in a network 
5 comprising network devices and links to provide a stress value representing the 

performance of the network or a part thereof, the method comprising: 

obtaining a raw value of data for a monitored characteristic of a network device 

or link; 

comparing said raw vahie with a predetermined threshold value for said monitored 
10 characteristic; 

if said raw data vahie is greater than or equal to said threshold value, providing 
a stress value equal to a default value, said default value being a TnaYiffTpm or minimnnT 
value of a predefined bounded range; and 

if said raw value is less than said threshold value, calculating a stress value within 
15 said predefined bounded range using an appropriate algorithm for said monitored 
characteristic. 

2. A method as claimed in claim 1, wherein said monitored characteristic relates to 
the port of a networic device and concerns the utilisation of the link connected to the 

20 device. 

3. A method as claimed in claim 2, wherein said monitored characteristic includes 
one of link utilisation in fimes per second; link error rate in flames per second; collisions 
per second, and broadcast fiames per second. 

25 

4. A method as claimed in claim 1, 2 or 3, wiierein said step of obtaining a raw value 
comprises receiving said raw value fi"om memory in a network device. 



5 A method as claimed in claim 1 , 2 or 3 , wherein said step of obtaining a raw value 
30 comprises receiving data values fi^om memory in a network device, and calculating said 
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raw value for said monitored charaaeristic using said data values. 



10 



20 



6. A method as claimed in claim 1, wherein said monitored characteristic relates to 
the operating speed of hardware within a network device. 

7. A method as claimed in claim 6, wherein said monitored characteristic includes 
one of: IP Ping response time; DNS response time: FTP response time; HTTP response 
time; P0P3 response time; SMTP response time, and NFS response time. 



8. A method as claimed m claim 6 or claim 7, \rfierdn said step of obtaining a raw 
value comprises: 

sending a signal to said hardware in said network device, \rfuch signal prompts a 
response from said hardware, and 

timing the period for the response to be received; 
15 wherein said tuned time period is the raw value. 

9. A method as claimed in daim 1, wherein said monitored characteristic is a 
diaracteristic relating to errors occurring in a core networic device. 



1 0. A method as claimed in daim 9, wha-ein said monitored characteristic includes 
one of: frames per second discarded due to excessive delay; frames per second discarded 
due to MTU exceeded; frames per second discarded because filtering table is M, and 
rate of topology changes. 



25 11. A metiiod as claimed in claim 9 or claim 1 0, wherein said step of obtaining a raw 
value comprises receiving said raw value from memory m said core network device. 



30 



12. A metiiod as daimed in any preceding daim, wherein said predefined bounded 
range is 0 to 100, where tiie default value is 100 if it is tiie maximum vahie and 0 if it is 
the minimum value. 
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13. A method as claimed in any preceding claim, further comprising displaying said 
stress value as alphanumeric text or in graphical form on a display screen. 

14. A method as claimed in any preceding claim, wherein the threshold value for the 
5 monitored characteristic is adjustable by the user. 

15. A method for processing data representing monitored characteristics in a network 
comprising network devices and links to provide a stress value representing the 
performance of the network, the method conqmsing: 

10 obtaining a plurality of raw values of data for a corresponding plurality of 

monitored characteristics of a network device or link; 

comparing each raw value with a predetermined threshold value for said 
corresponding monitored characteristic; 

for each raw value determining a stress value within a predetermined bounded 

15 range of values, wherein if said raw data value is greater than or equal to said 
corresponding threshold value, determining a stress value equal to a default value, said 
de&ult value being either the maximum or minnnum value of said predefined bounded 
range; and if said raw value is less than said threshold value, calculating a stress value 
within said predefined bounded range using an appropriate algorithm for said monitored 

20 characteristic. 

16. A method as claimed in daim 15, further comprising aggregating the stress values 
obtained for each of said plurality of monitored characteristics to provide an aggregated 
stress value. 

25 

1 7. A method for processing data represeoting monitored characteristics in a network 
comprising network devices and links to provide a stress value representing the 
performance of the network substantially as hereinbefore described, with reference to the 
accompanying drawings. 

30 
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18. A computer readable medium containing a computer program for canying out the 
method as claimed in any preceding claim. 

19. Apparatus for processing data representing monitored characteristics in a network 
comprising networic devices and links to provide a stress value representing the 
performance of the nrtworic, the ^paratus comprising: 

a network connection or port for receiving a raw value of data for a monitored 
diaractoistic of a network device or link; 

a processor for conq>aring said raw vabe with a predetermined threshold value 
for said monitored characteristic obtained from memoiy; and if the comparison detennines 
that raw data value is greater than or equal to said threshold vahie, providing a stress 
value equal to a de&ult vahie, said de^ vahie being a maximum or minimum vahie of 
a predefined bounded range; and if the comparison determines that said raw value is less 
than said threshold value, calculating a stress value within said predefined bounded range 
using an appropriate algorithm for said monitored characteristic stored in memory. 

20. Apparatus as claimed in daim 19, wherein said monitored characteristic nslates to 
the port of a network device and concerns the utilisation of the link connected to the 
device. 

21. Apparatus as claimed in claim 20, wheran said monitoiBd characteristic inchides 
one of: Hnk utilisation in fiames per second; link error rate in fiames per second; OT^^ 
per second, and broadcast fitames per second. 

22. Apparatus as claimed in claim 19, 20 or 21, wherem said apparatus obtains said 
raw value by receiving said raw value at said port from memory in a networic device. 

23. Apparatus as claimed in claim 19, 20 or 21. wherein said apparatus obtains said 
raw vahie by receiving data values at said port from memory in a network device, and said 
processor calculating said raw value for said monitored characteristic using said received 
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data values. 

24. Apparatus as claimed in claim 1 9, wherein said monitored characteristic relates to 
the operating speed of hardware within a network device. 

5 

25. Apparatus as claimed in claim 24, wherein said monitored characteristic includes 
one of: IP Ping response time; DNS response time: FTP response time; HTTP response 
time; POPS response time; SMTP response time, and NFS response time. 

1 0 26. Apparatus as claimed in claim 25 or claim 26, \^*erein said apparatus obtains said 
raw value by sending a signal to said hardware in said network device, which signal 
prompts a response from said hardware, and timing the period for the response to be 
received; wherein said timed time period is the raw value used by said processor. 

15 27. Apparatus as claimed in daim 19, wherein said monitored characteristic is a 
characteristic relating to errors occurring in a core network device. 

28. Apparatus as claimed in claim 27, wherein said monitored characteristic includes 
one of: frames per second discarded due to excessive delay; frames per second discarded 

20 due to MTU exceeded; frames per second discarded because filtering table is M, and 
rate of topology changes. 

29. Apparatus as claimed in daim 27 or claim 28, wherein said apparatus obtains said 
raw value by receiving said raw value at said port from memory in said core network 

25 device. 

30. Apparatus as claimed in claim 27 or claim 28, wherein said apparatus obtains said 
raw value by receiving data values at said port from memory in a network device, and said 
processor calculating said raw value for said monitored characteristic using said received 

30 data values. 
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3 1. Apparatus as claimed in any one of claims 19 to 30, wherein said predefined 
bounded range is 0 to 100, where the default value is 100 if it is the maximum value and 
0 if it is the minimum value. 

32. Apparatus as claimed in any one of claimsl9 to 3 1, fimher comprising a display 
for receiving said stress value fi-om said processor and displaying said s&ess value as 
alphanumeric text or in gr^hical fonn. 

33. Apparatus as claimed in any one of claims 19 to 32. fimher comprising memoiy 
to store said predetermined threshold value. 

34. Apparatusasclahnedindaim33,fiirthercomprisingmeansforwritingathreshoW 
value for a monitored characteristic to said memory. 

35. Apparatus as claimed in any one of claims 19 to 34, wherein said apparatus is 
capable of obtaining a plurality of raw values of data for a coiresponding pluiaHty of 
monitored characteristics of a network device or link at said port, and said prx)cessor is 
adapted to compare each raw value with a predetermined threshold vahie for said 
corresponding monitored characteristic retrieved from memoiy, and for each raw vahie 
detenniningastressvaluewithinapredetenninedboundedrangeofvahies, whereinifsaid 
rawdata value is greaterthan or equal to said corresponding threshold value, detennining 

a stress value equal to a defauh value, the defeult vahie bemg either a maximum or 
minimum vahie of said predefined bounded range; and if said raw value is less than said 
threshold value, calculating a stress vahie within said predefined bomided range using an 
appropriate algorithm for said monitored characteristic, the processor thereby providing 
a phirality of stress values coiresponding to said plurality of raw values.. 



36. Apparatus as claimed in claim 35, wherem said processor if fiirther adapted to 
aggregate the plurahty of stress values for each of said plurality of monitored 
characteristics to provide an aggregated stress value. 
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37. Apparatus substantially as hereinbefore described with reference to, and as shown 
in, the accompanying drawings. 
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